Extracted

• • Target

    file.exe

  • Size

    416KB

  • MD5

    20a6b393d5c098d4e95c49ebd4350a76

  • SHA1

    8038616ee029c9a51a7c95cac57033a10f091c8e

  • SHA256

    3ba533f3f515c41fd7a24e3ff94ff72e5e68c1b78d0ddfd316e780f6b8fe5732

  • SHA512

    e0486c2ddfdccbe7a350a3c4a2942b9e100c0a32c75763f339aa248445c3676eb323af014e644b4eac4f784fd2ce7b232ff5ebb416290b1acbfbdb96db00d52c

  • SSDEEP

    6144:WEAJsLHf/7wloTOxDS/pn+aXUjLu+jBr5yigSBWs6B8PPMk:WEAm737gM2oYaXUjS+x5yzS76B8

  Score

  10^/10

  amadeycollectionspywarestealertrojan

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey

  • Detect Amadey credential stealer module

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection
  behavioral1behavioral2